feat(myopencre): add CSV upload UI and wire to existing import endpoint#664
feat(myopencre): add CSV upload UI and wire to existing import endpoint#664PRAteek-singHWY wants to merge 12 commits intoOWASP:mainfrom
Conversation
Review focus (apologies for noisy diff)Apologies for the additional file changes — the actual functionality introduced in this PR is confined to:
Other modified files are unrelated to the MyOpenCRE upload flow and were pulled in while rebasing/syncing branches. Happy to clean these up or move them into a separate PR if that’s preferred. |
|
This PR is part of the MyOpenCRE frontend flow resolving #584. Full context and next steps are summarized on the issue. |
|
This is some epic level work. Thank you @PRAteek-singHWY! |
f1dcd6b to
084d115
Compare
Sir @northdpole, Ready for review — thank you! I really appreciate your feedback and guidance; I’m learning a lot from this. |
24f0573 to
288a8b3
Compare
612927a to
a0b7778
Compare
|
the more i look at this pr train the more i think you missed some conflicts, all good, let's resolve them all so we can merge all of it. excited to have this feature working! |
@northdpole Yes that's a bit of pain, surely i'll resolve all conflicts ASAP. |
df74ffc to
99de5c6
Compare
99de5c6 to
49b0ea2
Compare
#662 (CSV download of all CREs)
Please review after the above PR is merged.
Summary
Closes #584 (partial)
Adds the next step of the MyOpenCRE user flow by introducing a frontend UI for CSV upload, allowing users to map their own security standards to OpenCRE without using curl.
This PR wires the existing CSV import backend endpoint to a simple, feature-flagged UI.
⸻
What this PR does
This PR introduces a MyOpenCRE frontend page that allows users to:
• ✅ Download the full CRE catalogue as a CSV
• ✅ Upload a CSV mapping a custom standard (e.g. SOC2) to existing CREs
• ✅ Import mappings via the existing /rest/v1/cre_csv_import endpoint
• ✅ Respect the CRE_ALLOW_IMPORT feature flag:
• Enabled for local execution
• Disabled on hosted OpenCRE (Heroku) to prevent resource abuse
This removes the need to use curl for CSV import/export and makes MyOpenCRE usable by non-technical users.
⸻
Why this is needed
The MyOpenCRE API has been stable for some time, but until now it required manual API usage via curl.
This PR:
• Exposes existing backend functionality through a UI
• Matches the original issue’s acceptance criteria
• Enables the intended user journey for mapping custom standards to CREs
No backend logic is changed — this PR focuses on UI enablement only.
⸻
Scope
• Frontend only
• Uses existing backend endpoints
• No changes to import logic or data model
• No async processing or progress tracking (intentionally out of scope)
⸻
How it was tested
• Ran OpenCRE locally with:
-> export CRE_ALLOW_IMPORT=true
-> make dev-flask
• Downloaded the CRE catalogue CSV
• Added a test standard and mapped it to existing CRE IDs
• Uploaded the CSV via the MyOpenCRE UI
• Verified successful import response
⸻
Screenshots
⸻
Dependencies
• #662 – CSV download of all CREs
Please review after the above PR is merged.
⸻
Future work (out of scope for this PRPR and most probably this issue)
The following are intentionally excluded to keep scope focused and reviewable:
• Async/background CSV import
• Import progress UI
• Improved error UX
• “Dry-run” / validation-only import mode
These are good candidates for follow-up PRs.